U.S. patent number 11,050,567 [Application Number 16/689,612] was granted by the patent office on 2021-06-29 for security authentification system for membership login of online website and method thereof.
This patent grant is currently assigned to eBay Inc.. The grantee listed for this patent is EBAY KOREA CO., LTD.. Invention is credited to Jin Yong Lee.
United States Patent |
11,050,567 |
Lee |
June 29, 2021 |
Security authentification system for membership login of online
website and method thereof
Abstract
Disclosed is a security authentication system for a membership
login of an online website capable of ensuring a safe membership
login without having to directly entering a membership ID and a
password for a membership login of a certain online website on a
user terminal being used in association with a smartphone for a
private or public purpose, and a method thereof.
Inventors: |
Lee; Jin Yong (Seongnam-si,
KR) |
Applicant: |
Name |
City |
State |
Country |
Type |
EBAY KOREA CO., LTD. |
Seoul |
N/A |
KR |
|
|
Assignee: |
eBay Inc. (San Jose,
CA)
|
Family
ID: |
1000005647680 |
Appl.
No.: |
16/689,612 |
Filed: |
November 20, 2019 |
Prior Publication Data
|
|
|
|
Document
Identifier |
Publication Date |
|
US 20200162257 A1 |
May 21, 2020 |
|
Related U.S. Patent Documents
|
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
Issue Date |
|
|
15550673 |
|
10554410 |
|
|
|
PCT/KR2016/001382 |
Feb 11, 2016 |
|
|
|
|
Foreign Application Priority Data
|
|
|
|
|
Feb 11, 2015 [KR] |
|
|
10-2015-0021150 |
|
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
G06Q
20/3274 (20130101); G06F 21/42 (20130101); H04L
9/3228 (20130101); G06Q 20/425 (20130101); G06Q
20/3827 (20130101); G06Q 20/385 (20130101); H04L
9/32 (20130101); H04L 63/0838 (20130101); G06Q
20/3276 (20130101); G06F 21/36 (20130101); H04L
9/08 (20130101); H04L 63/18 (20130101); G06Q
20/4014 (20130101); H04L 9/3236 (20130101); H04W
12/068 (20210101) |
Current International
Class: |
H04L
9/32 (20060101); G06F 21/36 (20130101); H04L
29/06 (20060101); G06Q 20/40 (20120101); G06Q
20/32 (20120101); G06Q 20/38 (20120101); H04W
12/06 (20210101); G06F 21/42 (20130101); H04L
9/08 (20060101); G06Q 20/42 (20120101) |
References Cited
[Referenced By]
U.S. Patent Documents
Foreign Patent Documents
|
|
|
|
|
|
|
103428001 |
|
Dec 2013 |
|
CN |
|
107431619 |
|
Dec 2017 |
|
CN |
|
3258642 |
|
Dec 2017 |
|
EP |
|
2010-211294 |
|
Sep 2010 |
|
JP |
|
2002-0096258 |
|
Dec 2002 |
|
KR |
|
10-1205863 |
|
Dec 2012 |
|
KR |
|
10-2013-0078842 |
|
Jul 2013 |
|
KR |
|
10-1348249 |
|
Jan 2014 |
|
KR |
|
10-2014-0106310 |
|
Sep 2014 |
|
KR |
|
10-2014-0106360 |
|
Sep 2014 |
|
KR |
|
10-1652625 |
|
Aug 2016 |
|
KR |
|
10-1753535 |
|
Jul 2017 |
|
KR |
|
2016/129926 |
|
Aug 2016 |
|
WO |
|
2016/129929 |
|
Aug 2016 |
|
WO |
|
Other References
Response to Office Action filed on Apr. 7, 2020 for Chinese Patent
Application No. 201680021361.1, dated Nov. 21, 2019, 26 pages (10
pages of Official Copy & 16 pages of English Pending Claims).
cited by applicant .
Notice of Allowance for Korean Patent Application No.
10-2015-0021150, dated May 24, 2016, 3 pages (1 page of English
Translation and 2 pages of Official Copy). cited by applicant .
Office Action received for Korean Patent Application No.
10-2015-0021150, dated Dec. 10, 2015, 16 pages (6 pages of Official
Copy and 10 pages of English Pending Claims). cited by applicant
.
Response to Office Action filed on Mar. 8, 2016 for Korean Patent
Application No. 10-2015-0021150, dated Dec. 10, 2015, 32 pages (1
page of English Translation, 24 pages of Official Copy and 7 pages
of English Pending Claims). cited by applicant .
Notice of Allowance received for Korean Patent Application No.
10-2016-0107599, dated Apr. 13, 2017, 3 pages (1 page of English
Translation and 2 pages of Official Copy). cited by applicant .
Office Action received for Korean Patent Application No.
10-2016-0107599, dated Oct. 14, 2016, 12 pages (6 pages of Official
Copy and 6 pages of English Pending Claims). cited by applicant
.
Response to Office Action filed on Dec. 12, 2016 for Korean Patent
Application No. 10-2016-0107599, dated Oct. 14, 2016, 23 pages (1
page of English Translation, 16 pages of Official Copy and 6 pages
of English Pending claims). cited by applicant .
Communication Pursuant to Article 94(3) EPC Received for European
Patent Application No. 16749469.9, dated Sep. 26, 2019, 3 pages.
cited by applicant .
Extended European Search report received for European Patent
Application No. 16749469.9, dated Oct. 16, 2017, 7 pages. cited by
applicant .
Response to Communication Pursuant to Article 94(3) EPC filed on
Oct. 23, 2019 for European Patent Application No. 16749469.9, dated
Sep. 26, 2019, 29 pages. cited by applicant .
Response to European Search Report filed on Apr. 30, 2018 for
European Patent Application No. 16749469.9, dated Oct. 16, 2017, 21
pages. cited by applicant .
Office Action received for Chinese Patent Application No.
201680021361.1, dated Nov. 21, 2019, 20 Pages (9 pages of Official
Copy and 11 pages of English Translation)). cited by applicant
.
Mizuno et al., "Authentication Using Multiple Communication
Channels", Nov. 11, 2005, 9 pages. cited by applicant .
International Preliminary Report on Patentability received for PCT
Application No. PCT/KR2016/001382, dated Aug. 24, 2017, 28 pages
(19 pages of English Translation and 9 pages of Official Copy).
cited by applicant .
International Search Report received for PCT Patent Application No.
PCT/KR2016/001382, dated Jun. 15, 2016, 5 pages (2 pages of English
Translation and 3 pages of Official Copy). cited by applicant .
Witten Opinion received for PCT Patent Application No.
PCT/KR2016/001382, dated Jun. 15, 2016, 26 pages (17 pages of
English Translation and 9 pages of Official Copy). cited by
applicant .
Office Action received for Chinese Patent Application No.
201680021361.1, dated Jun. 10, 2020, 22 pages (12 Pages of English
Translation and 10 Pages of Official Copy). cited by applicant
.
Response to Office Action filed on Aug. 25, 2020, for Chinese
Patent Application No. 201680021361.1, dated Jun. 10, 2020, 12
pages (8 pages of Official Copy & 4 pages of English
Translation of claims). cited by applicant .
Corrected Notice of Allowability received for U.S. Appl. No.
15/550,673, dated Jan. 6, 2020, 2 pages. cited by applicant .
Non-Final Office Action received for U.S. Appl. No. 15/550,673,
dated Feb. 6, 2019, 14 pages. cited by applicant .
Notice of Allowance received for U.S. Appl. No. 15/550,673, dated
Aug. 8, 2019, 9 pages. cited by applicant .
Preliminary Amendment filed on Aug. 11, 2017 for U.S. Appl. No.
15/550,673, 8 pages. cited by applicant .
Response to Non-Final Office Action filed on Jul. 8, 2019 for U.S.
Appl. No. 15/550,673, dated Feb. 6, 2019, 12 pages. cited by
applicant.
|
Primary Examiner: Poltorak; Piotr
Attorney, Agent or Firm: Shook, Hardy & Bacon LLP
Parent Case Text
CLAIM OF PRIORITY
This Applications is a continuation of U.S. application Ser. No.
15/550,673, filed Aug. 11, 2017, which is is a U.S. National Stage
Filing under 35 U.S.C. 371 from International Application No.
PCT/KR2016/001382, filed on 11 Feb. 2016, and published as WO
2016/129929 on 8 Aug. 2016, which claims the benefit of Korean
Application Serial No. 10-2015-0021150, filed on 11 Feb. 2015,
which applications and publication are incorporated by reference
herein in their entirety.
Claims
What is claimed is:
1. A method at an authentication server, the method comprising:
providing, to a first device, one-time use authentication
information for a website prior to receiving user login
authentication information for the website; receiving, from a
second device, an authentication request based on the one-time use
authentication information and the user login authentication
information; in response to verifying the authentication request,
providing, to the second device, one-time password (OTP)
information for the website; and receiving, from the first device,
a login request based on the OTP information.
2. The method of claim 1, wherein the login request comprises the
OTP information and the one-time use authentication information for
the website.
3. The method of claim 1, wherein the first device is configured to
present a QR code based on the one-time user authentication
information; and wherein the second device is configured to scan
the QR code and identify the one-time user authentication
information based on the QR code.
4. The method of claim 1, wherein the method further comprises:
receiving, from the first device, a request to log in to the
website; and in response to the request, generating the one-time
use authentication information.
5. The method of claim 4, wherein the one-time use authentication
information is generated based at least in part on an IP address of
the first device and/or a time stamp corresponding to a time of
issuance of the one-time use authentication information.
6. The method of claim 1, wherein the method further comprises: in
response to verifying the authentication request, generating the
OTP information.
7. The method of claim 6, wherein the OTP information is generated
based at least in part on an IP address of the second device, the
one-time use authentication information, the user login
authentication information, and/or an IP address of the first
device.
8. A computing apparatus, the computing apparatus comprising: a
processor; and a memory storing instructions that, when executed by
the processor, configure the apparatus to perform operations
comprising: providing, to a first device, one-time use
authentication information for a website prior to receiving user
login authentication information for the website; receiving, from a
second device, an authentication request based on the one-time use
authentication information and the user login authentication
information; in response to verifying the authentication request,
providing, to the second device, one-time password (OTP)
information for the website; and receiving, from the first device,
a login request based on the OTP information.
9. The computing apparatus of claim 8, wherein the login request
comprises the OTP information and the one-time use authentication
information for the website.
10. The computing apparatus of claim 8, wherein the first device is
configured to present a QR code based on the one-time user
authentication information; and wherein the second device is
configured to scan the QR code and identify the one-time user
authentication information based on the QR code.
11. The computing apparatus of claim 8, wherein the operations
further comprise: receiving, from the first device, a request to
log in to the website; and in response to the request, generating
the one-time use authentication information.
12. The computing apparatus of claim 11, wherein the one-time use
authentication information is generated based at least in part on
an IP address of the first device and/or a time stamp corresponding
to a time of issuance of the one-time use authentication
information.
13. The computing apparatus of claim 8, wherein the operations
further comprise: in response to verifying the authentication
request, generating the OTP information.
14. The computing apparatus of claim 13, wherein the OTP
information is generated based at least in part on an IP address of
the second device, the one-time use authentication information, the
user login authentication information, and/or an IP address of the
first device.
15. A non-transitory computer-readable storage medium including
instructions that when executed by a computer, cause the computer
to perform operations comprising: providing, to a first device,
one-time use authentication information for a website prior to
receiving user login authentication information for the website;
receiving, from a second device, an authentication request based on
the one-time use authentication information and the user login
authentication information; in response to verifying the
authentication request, providing, to the second device, one-time
password (OTP) information for the website; and receiving, from the
first device, a login request based on the OTP information.
16. The non-transitory computer-readable storage medium of claim
15, wherein the login request comprises the OTP information and the
one-time use authentication information for the website.
17. The non-transitory computer-readable storage medium of claim
15, wherein the operations further comprise: receiving, from the
first device, a request to log in to the website; and in response
to the request, generating the one-time use authentication
information.
18. The non-transitory computer-readable storage medium of claim
17, wherein the one-time use authentication information is
generated based at least in part on an IP address of the first
device and/or a time stamp corresponding to a time of issuance of
the one-time use authentication information.
19. The non-transitory computer-readable storage medium of claim
15, wherein the operations further comprise: in response to
verifying the authentication request, generating the OTP
information.
20. The non-transitory computer-readable storage medium of claim
19, wherein the OTP information is generated based at least in part
on an IP address of the second device, the one-time use
authentication information, the user login authentication
information, and/or an IP address of the first device.
Description
BACKGROUND
1. Field of Invention
The present invention relates to a security authentication system
for a membership login of an online website and a method thereof,
and more particularly, a security authentication system for a
membership login of an online website capable of ensuring a safe
membership login without having to directly entering a membership
ID and a password for a membership login of a certain online
website on a user terminal being used in association with a
smartphone for a private or public purpose, and a method
thereof.
2. Discussion of Related Art
In general, log-in represents an authentication process in which a
user accesses a multiple user system through a network and enters
authentication information that is previously registered on a
terminal, such as an identification (ID) and a password, and the ID
and the password are verified, so that the user is authenticated to
use the system, thereby allowing the user to perform a task on the
system.
Such a login process is widely used to verify a user in various
systems connected through a network. Currently, the login process
is achieved as a user accesses a certain online website on a
terminal provided with a web browser and manually transmits login
information for using the online web site, that is, a user
identification and a password, to a web server through the
terminal, so that a user authentication is granted.
With the recent development of computer and information
communication, people of various sections obtain desired
information by accessing an online website that provides various
types of information on the Internet, and most online websites
require a membership login to use the corresponding
information.
Accordingly, users enter private information, such as a name, a
social security number, an address, an e-mail address, and a phone
number according to a membership sign-in procedure and a sign-in
form that are required in the online website, and also set a unique
identification and password for login to the online website.
Therefore, when a user visits an online website where the user has
signed and which is operated based on a membership system, the user
logins to the website through the previously established ID and
password of the user to use information provided by the online
website.
However, such a method has a risk in that once a user accesses a
website in an online game room, a hacker may appropriate the ID and
password of the user through a cracking of a PC in the game room or
by using an illegal program that combines an ID and a password.
In order to remove such a risk, various types of security
authentication methods have been developed. Korean Unexamined
Patent Publication No. 10-2002-0096258 (a method of authentication
for the Internet) discloses a method of authenticating a user by
entering iris image information of a user. To this end, a system
used in the prior art requires a private terminal provided with a
function to transmit iris information, and a network service
provider is also required to have a database (DB) to store iris
information of users in a server.
However, the conventional system and method concern a primary
authentication of a user who desires access to an online website or
desires payment on the Internet, which fails to deal with a
situation where an unauthorized user accesses through an ID of an
authorized user, and such a conventional system and method are not
available to a general user who does not have a terminal for
transmitting iris image information.
PRIOR ART DOCUMENT
(Patent document 0001) Korean Unexamined Patent Publication No.
10-2002-0096258
SUMMARY OF THE INVENTION
The present invention is directed to a security authentication
system for a membership login of an online website, capable of
ensuring a safe membership login without having to directly
entering an 1D and a password for a membership login of a certain
online website on a user terminal being used in association with a
smartphone for a private or public purpose, and a method
thereof.
According to a first aspect of the present invention, there is
provided a security authentication system for a membership login of
an online website, the security authentication system including: at
least one user terminal; a smartphone configured to perform a
security authentication related application service; and a security
authentication server configured to a security authentication
service for a membership login of a certain online website, wherein
the user terminal requests a security authentication for a
membership login of a certain online website from the security
authentication server, by using One Time Password (OTP) information
transmitted to the smartphone through the security authentication
server and one time use authentication information transmitted from
the security authentication server; a security authentication
related application installed on the smartphone scans and analyzes
the one time use authentication information transmitted from the
security authentication server and displayed on a screen of the
user terminal, and requests OTP information from the security
authentication server by using the analyzed one time use
authentication information and actual membership login
authentication information of an online website; and the security
authentication server generates one time use authentication
information for a membership login of a certain online website
requested by the user terminal, transmits the generated one time
use authentication information to the user terminal, verifies one
time use authentication information requested by the smartphone and
actual membership login authentication information of a certain
online website, generates OTP information if a corresponding user
is an authenticated member, transmits the generated OTP information
to the corresponding smartphone, performs a verification process on
the security authentication for the membership login of the online
website requested by the user terminal, and if the user is a
security authenticated member, normally processes the membership
login of the online website.
The security authentication server may make the generated one time
use authentication information into a database (DB) and store the
DB in an additional storage device.
The one time use authentication information generated through the
security authentication server may include a randomly generated
globally unique identifier (GUID), an IP address of a user terminal
having requested a membership login, a timestamp at the time of
issuing the one time use authentication information, and random
data that are arranged in the order of the GUID, the IP address of
the user terminal, the timestamp and the random data.
The randomly generated GUID of the one time use authentication
information generated through the security authentication server
may be stored as a key or an index, and the remaining information
may be stored as a value or a column in an additional storage
device.
The security authentication server, at the time of transmitting the
generated one time use authentication information to the user
terminal, may encrypt the generated one time use authentication
information, and include a hash value about the generated one time
use authentication information and information about a length of
the encrypted one time use authentication information in the
encrypted one time use authentication information to be
transmitted.
The security authentication server may generate the one time use
authentication information in the form of a OR code image and
transmits the one time use authentication information such that the
one time use authentication information is displayed on the screen
of the user terminal.
The security authentication related application installed on the
smartphone may extract data from the scanned one time use
authentication information, decrypt the extracted data, and then
verify fabrication modification of the data through a hash-based
message authentication code (HMAC).
A membership login for an online website may be requested by
entering an actual membership and an actual password of the online
website through the security authentication related application
installed on the smartphone, and actual membership login
authentication information of the online website may be received in
the form of a token data about a result of authentication of the
membership login.
The security authentication related application installed on the
smartphone, at the time of requesting the OTP information from the
security authentication server, may generate an OTP request query
by combining the analyzed one time use authentication information
with the actual membership login authentication information of the
online website and making a cryptogram from the result of
combination, and may transmit the OTP request query to the security
authentication server.
The security authentication server may verify a validity of
issuance of the one time use authentication information by
decrypting the OTP request query provided by the smartphone and
decrypting the one time use authentication information to inquire
about details of a validated issuance of the one time use
authentication information by using a GUID as a key.
The security authentication server may generate OTP information
based on an IP address of a smartphone having requested the OTP
information, a GUID included in the one time use authentication
information, an IP address of a user terminal having requested the
authentication, and a timestamp of a user terminal having requested
the authentication.
The user terminal, at the time of requesting a security
authentication for a membership login of a certain online website,
may simultaneously transmit the one time use authentication
information to a browser cookie and transmit the OTP information to
a Form (HTTP Post) value.
The security authentication server may extract one time use
authentication information from a user cookie requested by the user
terminal, verify a validity of issuance of the one time use
authentication information by decrypting the extracted one time use
authentication information to inquire about details of a validated
issuance of the one time use authentication information by using a
GUID as a key, and verify a validity of issuance of the OTP by
comparing the extracted one time use authentication information
with a record of OTP issuance.
According to a second aspect of the present invention, there is
provided a security authentication method for a membership login of
an online website by use of a system including a user terminal, a
smartphone and a security authentication server, the security
authentication method including operations of (a) by the security
authentication server, generating one time use authentication
information for a membership login of a certain online website
requested by the user terminal, and transmitting the generated one
time use authentication information to the user terminal; (b) by a
security authentication related application installed on the
smartphone, scanning and analyzing the one time use authentication
information transmitted in operation (a), and requesting One Time
Password (OTP) information from the security authentication server
by using the analyzed one time use authentication information and
actual membership login authentication information of an online
website; (c) by the security authentication server, verifying the
one time use authentication information requested in operation (b)
and the actual membership login authentication information of the
online website, generating OTP information if a corresponding user
is an authenticated member, transmitting the generated OTP
information to the corresponding smartphone; (d) by the user
terminal, requesting a security authentication for the membership
login of the online website from the security authentication
server, by using the OTP information transmitted in operation (c)
and the one time use authentication information transmitted in
operation (a); and (e) by the security authentication server,
performing a verification process on the security authentication
for the membership login of the online website requested in
operation (d), and if the user is a security authenticated member,
normally processing the membership login of the online website.
In operation (a), the security authentication server may make the
generated one time use authentication information into a database
(DB) and store the DB in an additional storage device.
In operation (a), the generated one time use authentication
information may include a randomly generated globally unique
identifier (GUID), an IP address of a user terminal having
requested a membership login, a timestamp at the time of issuing
the one time use authentication information, and random data that
are arranged in the order of the GUID, the IP address of the user
terminal, the timestamp and the random data.
The randomly generated GUID of the one time use authentication
information generated through the security authentication server
may be stored as a key or an index, and the remaining information
may be stored as a value or a column in an additional storage
device.
In operation (a), the security authentication server, at the time
of transmitting the generated one time use authentication
information to the user terminal, may encrypt the generated one
time use authentication information, and include a hash value about
the generated one time use authentication information and
information about a length of the encrypted one time use
authentication information in the encrypted one time use
authentication information to be transmitted.
In operation (a), the security authentication server may generate
the one time use authentication information in the form of a QR
code image and transmits the one time use authentication
information such that the one time use authentication information
is displayed on a screen of the user terminal.
In operation (b), the security authentication related application
installed on the smartphone may extract data from the scanned one
time use authentication information, decrypt the extracted data,
and then verify fabrication/modification of the data through a
hash-based message authentication code (HMAC).
In operation (b), a membership login for an online website may be
requested by entering an actual membership ID and an actual
password of the online website through the security authentication
related application installed on the smartphone, and actual
membership login authentication information of the online website
may be received in the form of a token data about a result of
authentication of the membership login.
In operation (b), the security authentication related application
installed on the smartphone, at the time of requesting the OTP
information from the security authentication server, may generate
an OTP request query by combining the analyzed one time use
authentication information with the actual membership login
authentication information of the online website and making a
cryptogram from the result of combination, and may transmit the OTP
request query to the security authentication server.
In operation (c), the security authentication server may verify a
validity of issuance of the one time use authentication information
by decrypting the OTP request query provided in operation (b), and
then by decrypting the one time use authentication information to
inquire about details of a validated issuance of the one time use
authentication information by using a GUID as a key.
In operation (c), the security authentication server may generate
OTP information based on an IP address of a smartphone having
requested the OTP information, a GUID included in the one time use
authentication information, an IP address of a user terminal having
requested the authentication, and a timestamp.
In operation (d), the user terminal, at the time of requesting a
security authentication for a membership login of a certain online
website, simultaneously may transmit the one time use
authentication information to a browser cookie and transmit the OTP
information to a Form (HTTP Post) value.
In operation (e), the security authentication server may extract
one time use authentication information from a user cookie
requested by the user terminal, verify a validity of issuance of
the one time use authentication information by decrypting the
extracted one time use authentication information to inquire about
details of a validated issuance of the one time use authentication
information by using a GUID as a key, and verify a validity of
issuance of the OTP by comparing the extracted one time use
authentication information with a record of OTP issuance.
According to a third another aspect of the present invention, there
is provided a computer readable recording medium that records a
program for executing the above-described security authentication
method for a membership login of an online website.
The security authentication method for a membership login of an
online website according to the exemplary embodiment of the present
invention may be implemented as a code in a recording medium that
is readable by a computer. The computer readable recording medium
may include all types of recording devices storing data readable by
a computer system.
For example, the computer readable recording medium may include a
read-only memory (ROM), a random-access memory (RAM), a CD-ROM, a
magnetic tape, a hard disk, a floppy disk, a mobile storage device,
a non-volatile memory, and an optical data storage device.
BRIEF DESCRIPTION OF THE DRAWINGS
The above and other objects, features and advantages of the present
invention will become more apparent to those of ordinary skill in
the art by describing in detail exemplary embodiments thereof with
reference to the accompanying drawings, in which:
FIG. 1 is an overall block diagram illustrating a security
authentication system for a membership login of an online website
according to an exemplary embodiment of the present invention;
FIG. 2 is a diagram illustrating a data structure of onetime use
authentication information generated through a security
authentication server applied to an exemplary embodiment of the
present invention;
FIG. 3 is a diagram illustrating a data structure of onetime use
authentication information transmitted to a user terminal through a
security authentication server applied to an exemplary embodiment
of the present invention;
FIG. 4 is a diagram illustrating onetime use authentication
information displayed on a screen of a user terminal applied to an
exemplary embodiment of the present invention;
FIG. 5 is a diagram illustrating OTP information displayed on a
screen of a smartphone applied to an exemplary embodiment of the
present invention;
FIG. 6 is a diagram illustrating one time use authentication
information and OTP information that are displayed on a user
terminal for security authentication on a membership login of a
certain online website applied to an exemplary embodiment of the
present invention;
FIG. 7 is an overall flowchart showing a security authentication
method for a membership login of an online website according to an
exemplary embodiment of the present invention;
FIG. 8 is an overall flowchart showing operations among elements,
which illustrates a security authentication method for a membership
login of an online website according to an exemplary embodiment of
the present invention;
FIG. 9 is a detailed flowchart showing operations between a user
terminal and a security authentication server, which illustrates
generation and issuance of one time use authentication information
in a security authentication method for a membership login of an
online website according to an exemplary embodiment of the present
invention;
FIG. 10 is a detailed flowchart showing operations between a
smartphone and a security authentication server, which illustrates
a process of requesting OTP information issuance in a security
authentication method for a membership login of an online website
according to an exemplary embodiment of the present invention;
FIG. 11 is a detailed flowchart showing operations between a
smartphone and a security authentication server, which illustrates
a process of issuing and transmitting OTP information in a security
authentication method for a membership login of an online website
according to an exemplary embodiment of the present invention;
and
FIG. 12 a detailed flowchart showing operations between a user
terminal and a security authentication server, which illustrates a
security authentication process on a membership login of a certain
online website in a security authentication method for a membership
login of an online website according to an exemplary embodiment of
the present invention.
DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS
The above and other advantages, and a scheme for the advantages of
the present invention will become readily apparent by reference to
the following detailed description when considered in conjunction
with the accompanying drawings. However, the scope of the present
invention is not limited to such embodiments and the present
invention may be realized in various forms. The embodiments to be
described below are nothing but the ones provided to bring the
disclosure of the present invention to perfection and assist those
skilled in the art to completely understand the present invention.
The present invention is defined only by the scope of the appended
claims. In addition, the same reference numerals are used to
designate the same elements throughout the drawings. As used
herein, the term "and/or" includes any and all combinations of one
or more of the associated listed items.
It will be understood that, although the terms first, second, etc.
may be used herein to describe various elements, components,
regions, layers and/or sections, these elements, components,
regions, layers and/or sections should not be limited by these
terms. These terms are only used to distinguish one element,
component, region, layer or section from another element,
component, region, layer or section. Thus, a first element,
component, region, layer or section discussed below could be termed
a second element, component, region, layer or section without
departing from the teachings of the present inventive concept.
The terminology used herein is for the purpose of describing
particular embodiments only and is not intended to be limiting of
the invention. As used herein, the singular forms "a," "an" and
"the" are intended to include the plural forms as well, unless the
context clearly indicates otherwise. It will be further understood
that the terms "comprises," "comprising," "includes" and/or
"including," when used herein, specify the presence of stated
features, integers, steps, operations, elements, and/or components,
but do not preclude the presence or addition of one or more other
features, integers, steps, operations, elements, components, and/or
groups thereof.
Unless otherwise defined, all terms (including technical and
scientific terms) used herein have the same meaning as commonly
understood by one of ordinary skill in the art to which this
invention belongs. It will be further understood that terms, such
as those defined in commonly used dictionaries, should be
interpreted as having a meaning that is consistent with their
meaning in the context of the relevant art and will not be
interpreted in an idealized or overly formal sense unless expressly
so defined herein.
In the description of the embodiments, the detailed description of
related known functions or constructions will be omitted herein to
avoid making the subject matter of the present invention ambiguous.
In addition, terms which will be described below are defined in
consideration of functions in the embodiments of the present
invention, and may vary with an intention of a user and an operator
or a custom. Accordingly, the definition of the terms should be
determined based on overall contents of the specification.
FIG. 1 is an overall block diagram illustrating a security
authentication system for a membership login of an online website
according to an exemplary embodiment of the present invention, FIG.
2 is a diagram illustrating a data structure of one time use
authentication information generated through a security
authentication server applied to an exemplary embodiment of the
present invention, FIG. 3 is a diagram illustrating a data
structure of one time use authentication information transmitted to
a user terminal through a security authentication server applied to
an exemplary embodiment of the present invention, FIG. 4 is a
diagram illustrating one time use authentication information
displayed on a screen of a user terminal applied to an exemplary
embodiment of the present invention, FIG. 5 is a diagram
illustrating OTP information displayed on a screen of a smartphone
applied to an exemplary embodiment of the present invention, and
FIG. 6 is a diagram illustrating one time use authentication
information and OTP information that are displayed on a user
terminal for security authentication on a membership login of a
certain online website applied to an exemplary embodiment of the
present invention.
Referring to FIGS. 1 to 6, a security authentication system for a
membership login of an online website according to an exemplary
embodiment of the present invention includes at least one user
terminal 100, a smartphone 200 and a security authentication server
300.
The user terminal 100 is connected to the security authentication
server 300 through a communication network 10, and serves to
request generation of one time use authentication information for a
membership login of a certain online website (for example, Auction,
G market), receive the generated one time use authentication
information from the security authentication server 300, and
display the received one time user authentication information on a
screen as shown in FIG. 4.
In addition, the user terminal 100 requests a security
authentication for a membership login of a certain online website
from the security authentication server 300 by using One Time
Password (OTP) information transmitted to the smartphone 200
through the security authentication server 300 and one time use
authentication information transmitted from the security
authentication server 300 as shown in FIG. 6.
The user terminal 100, at the time of requesting a security
authentication for a membership login of a certain online website,
simultaneously transmits the one time use authentication
information to a browser cookie and transmits the OTP information
to a Form (HTTP Post) value.
The user terminal 100 may be provided as a desktop personal
computer (PC) used for a private purpose or public purpose (for
example, schools, internet cafes, and public facilities) and a
notebook personal computer, but the present invention is not
limited thereto. For example, the user terminal 100 may be provided
using all types of wired/wireless communication devices using a
security authentication service or a shopping mall related web
service by accessing the security authentication server 300 through
the communication network 10.
For example, the user terminal 100 may include various mobile
terminals communicating through a wireless Internet or a portable
Internet, and may further include all types of wired/wireless home
appliance/communication devices having a user interface gaining an
access to the security authentication server 300, for example, a
palm PC, a mobile play-station, a digital multimedia broadcasting
(DMB) phone having a communication function, a tablet PC, and an
iPad.
The smartphone 200 is a phone based on an open operating system
that has the freedom of downloading and deleting various
application programs desired by a user, differently from a general
handheld phone (referred to as a feature phone). That is, the
smartphone 200 may represent a communication device including a
mobile phone not only having a general function, such as
voice/video call and Internet data communication but also having a
mobile office function, or all types of Internet phones or tablet
PCs having Internet access without a voice call function.
The smartphone 200 may be implemented to have various open
operating systems mounted thereon. The open operating system may
include Symbian of NOKIA, Blackberry of RIMS, IPhone of Apple,
Windows Mobile of Microsoft, Android of Google, and Bada of
Samsung.
As such, the smartphone 200, which uses an open operating system,
may enable a user to randomly install and manage various
application programs, differently from a portable phone having a
closed operating system.
That is, the smartphone 200 basically includes a control unit, a
memory unit, a screen output unit, a key input unit, a sound output
unit, a sound input unit, a camera unit, a wireless network
communication module, a near field wireless communication module
and a battery for power supply.
The control unit collectively refers to functional elements to
control an operation of the smartphone 200, and includes at least
one processor and an execution memory. The control unit is
connected to each functional element of the smartphone 200 through
a Bus.
Such a control unit loads at least one program code provided on the
smartphone 200 on the execution memory and operates the loaded
program code through the processor, and transmits the result of
operation to the at least one functional element through the Bus,
thereby controlling the operation of the smartphone 200.
The memory unit collectively refers to non-volatile memories
provided on the smartphone 200, and serves to store and maintain at
least one program code executed through the control unit and at
least one dataset used by the program code. The memory unit
basically stores a system program code and a system dataset each
corresponding to an operating system of the smartphone 200, a
communication program code and a communication data set configured
to process a wireless communication connection of the smartphone
200, and at least one application program code and application
dataset. A program code and a dataset for implementing the present
invention are also stored in the memory unit.
The screen output unit is composed of a screen output device (for
example, a liquid crystal display (LCD)) and an output module to
drive the screen output device. The screen output unit is connected
to the control unit through the Bus, to output a result of
operation corresponding to a screen output among various operation
results of the control unit.
The key input unit is composed of a key input device provided with
at least one key button (or a touch screen device interoperating
with the screen output unit) and an input module to drive the key
input device. The key input unit is connected to the control unit
through the Bus, so that a command to instruct various operations
of the control unit is input, or data required for operation of the
control unit is input.
The sound output unit is composed of a speaker to output a sound
signal and a sound module to drive the speaker, and is connected to
the control unit through the Bus such that a result of operation
corresponding to sound output among various operation results of
the control unit is output through the speaker. The sound module
converts sound data to be output through the speaker into a sound
signal by decoding the sound data.
The sound input unit is composed of a microphone to receive a sound
signal and a sound module to drive the microphone, and is
configured to transmit sound data being input through the
microphone to the control unit. The sound module encodes the sound
signal being input through the microphone.
The camera unit is composed of an optical unit and a charge coupled
device (CCD), and a camera module to drive the optical unit and the
CCD. The camera unit is configured to obtain bitmap data that is
input to the CCD through the optical unit. The bitmap data may
include still image data and moving image data.
The wireless network communication module collectively refers to
communication elements that links wireless communication, and is
composed of at least one of an antenna to transmit/receive a radio
frequency signal at a certain frequency band, an RF module, a
baseband module, and a signal processing module. The wireless
network communication module is connected to the control unit
through the Bus, to transmit an operation result corresponding to a
wireless communication among various operation results of the
control unit in a wireless communication scheme, or to receive data
in a wireless communication scheme and deliver the received data to
the control unit, and at the same time, maintain access,
registration, communication and handoff procedures of the wireless
communication.
In addition, the wireless network communication module includes a
mobile communication element to perform at least one of an access
to a mobile communication network, location registration, call
process, call connection, data communication and handoff according
to the CDMA/WCDMA standards. Meanwhile, the wireless network
communication module may further include a portable Internet
communication element to perform at least one of an access to a
portable Internet, a location registration, a data communication
and a hand off according to the IEEE 802.16 standard depending on
the intention of those skilled in the art, and it should be
understood that the present invention is not limited to a wireless
communication element provided by the wireless network
communication module.
The near field wireless communication module is composed of a near
field wireless communication module configured to connect a
communication session by using a radio frequency signal as a
communication medium within a predetermined distance, and may
preferably include an RFID communication according to ISO180000
standards. Bluetooth communication, Wifi communication, and a
public wireless communication. In addition, the near field wireless
communication module may be integrated into the wireless network
communication module.
The smartphone 200 constructed as such represents a terminal
capable of performing a wireless communication. However, the
smartphone 200 may be provided using various devices other than a
smartphone as long as it may transmit and receive data through a
network including the Internet. That is, the smartphone 200 may
include a notebook PC and a table PC having a short message
transmission function and a network access function, and a portable
terminal capable of being carried and moved.
In particular, the smartphone 200 applied to the exemplary
embodiment of the present invention performs a security
authentication service or a shopping mall related application
service by downloading a security authentication related
application program or a shopping mall related application program
(for example Auction, G market App) through an App store.
In addition, the smartphone 200 may be connected to the security
authentication server 300 through the communication network 10, and
the communication network 10 may represent a communication network
of a high speed backbone network of a large scale network capable
of performing a large capacity and long distance voice/data
service, and represent a next generation wireless network including
WiFi, Wibro and Wimax providing the Internet or high speed
multimedia services.
The communication network 10 may be provided as a mobile
communication network, which is a synchronous mobile communication
network or an asynchronous mobile communication network. An
exemplary embodiment of the asynchronous mobile communication
network may be a wideband code division multiple access (WCDMA)
communication network. In this case, although not shown in the
drawings, the mobile communication network may include a radio
network controller (RNC). Although the detailed description thereof
will be made in relation to a WCDMA network as an example, the
communication network according to another example may be a 3G LTE
network, a 4G network, a 5G network and other next generation
communication networks, and IP-based networks. Such a communication
network 10 serves to deliver signals and data between the user
terminal 100 and the security authentication server 300 or signals
and data between the smartphone 200 and the security authentication
server 300.
In particular, a security authentication related application or a
shopping related application that is installed on the smartphone
200 serves to scan and analyze one time use authentication
information transmitted from the security authentication server 300
and displayed on the user terminal 100, and request OTP information
from the security authentication server 300 by using the analyzed
one time use authentication information and actual membership login
authentication information of a certain online web site.
In this case, the security authentication related application or
the shopping mall related application installed on the smartphone
200 extracts data from the scanned one time use authentication
information and decrypts the extracted data, and verifies
fabrication/modification of the data through a hash-based message
authentication code (HMAC).
In addition, the security authentication related application or the
shopping mall related application installed on the smartphone 200,
at the time of requesting the OTP information from the security
authentication server 300, generates an OTP request query by
combining the analyzed one time use authentication information with
the actual membership login authentication information of the
online website and making a cryptogram from the result of
combination, and transmits the OTP request query to the security
authentication server 300.
Moreover, the security authentication related application or the
shopping mall related application installed on the smartphone 200,
after requesting a membership login of a certain online website by
using an actual membership ID and an actual password of the online
website which are input by a user, receives actual membership login
authentication information of the online website in the form of a
token data about a result of authentication of the membership
login.
The security authentication server 300 performs a security
authentication service for a membership login of a certain online
website, and in this case, the security authentication server 300
generates one time use authentication information for a membership
login of the certain online website requested by the user terminal
100 and transmits the generated one time use authentication
information to the user terminal 100.
In this case, the security authentication server 300, at the time
of transmitting the generated one time use authentication
information to the user terminal 100, encrypts the generated one
time use authentication information and includes a hash value for
the generated one time use authentication information in the
encrypted one time use authentication to be transmitted as shown in
FIG. 3. That is, the security authentication server 300 may
transmit a hash-based message authentication code (HMAC) (SHA-256
scheme, 32 bytes) and information about a length of the encrypted
one time use authentication information (4 bytes) together with the
one time use authentication information.
That is, the security authentication server 300 may generate the
one time use authentication information in the form of a QR code
image, that is, a two dimensional bar code having encrypted data
embedded therein, and transmit the generated one time use
authentication information to a screen of the user terminal 100
such that the one time use authentication information is displayed
on the screen of the user terminal 100.
Meanwhile, the security authentication server 300 makes the
generated one time use authentication information into a database
(DB), and stores the DB in an additional storage device 350.
In addition, the one time use authentication information generated
through the security authentication server 300 has a data structure
including a randomly generated globally unique identifier (GUID)
(16 bytes), an IP address of the user terminal 100 having requested
a membership login (4 bytes), a timestamp at the time of issuing
the one time use authentication information (4 bytes), and random
data (32 bytes) that are arranged in the order of the GM, the IP
address of the user terminal, the timestamp of the user terminal
and the random data.
In this case, the randomly generated GUID of the one time use
authentication information is stored as a key or an index, and the
remaining information is stored as a value or a column in the
additional storage device 350 through the security authentication
server 300.
In addition, the security authentication server 300 verifiers the
one time use authentication information requested by the smartphone
200 and the actual membership login authentication information of
the certain online website, and if it is verified that the
corresponding user is an authenticated member, generates OTP
information and transmits the generated OTP information to the
smartphone 200 as shown in FIG. 5.
In this case, the security authentication server 300 verifies a
validity of issuance of the one time use authentication information
by decrypting the OTP request query provided by the smartphone 200,
and decrypting the one time use authentication information to
inquire about details of a validated issuance of the one time use
authentication information by using the GUID as a key.
In addition, the security authentication server 300 may generate
the OTP information based on an IP address of the smartphone 200
having requested the OTP information, a GUID included in the one
time use authentication information, an IP address of the user
terminal having requested the authentication, and a timestamp of
the user terminal having requested the authentication.
In addition, the security authentication server 300 performs a
verification process on the security authentication for the
membership login of the online website requested by the user
terminal 100, and if the user is a security authenticated member,
normally processes the membership login of the online website.
That is, the security authentication server 300 extracts one time
use authentication information from a user cookie requested by the
user terminal 100; verifies a validity of issuance of the one time
use authentication information by decrypting the extracted one time
use authentication information to inquire about details of a
validated issuance of the one time use authentication information
by using the GUID as a key; and verifies a validity of issuance of
the OTP by comparing the extracted one time use authentication
information with a record of OTP issuance.
Meanwhile, although not shown, the security authentication server
300 may be implemented to perform all functions of the above
described security authentication related service through a
shopping mall server (not shown) of a certain online website while
linked with the shopping mall server. Alternatively, the security
authentication server 300 may be substituted with the shopping
server to perform all the functions of the security authentication
server 300.
In this case, the shopping mall server serves to provide an online
shopping service such that products registered trough a seller
terminal are purchased by use of a shopping mall related
application service installed on the smartphone 200.
That is, the shopping server, which is a server for intermediating
a transaction between a seller and a buyer by operating an online
shopping mall service through the communication network 10,
collectively manages a webpage or online shopping services required
for operating a shopping mall such that various products to be sold
by a seller are registered from a seller terminal through the
communication network 10, and the registered various products are
provided to the smartphone 200 through a web server (not shown)
connected to the communication network 10, thereby enabling a buyer
to purchase a desired product.
In addition, the shopping mall server may manage a webpage or
online shopping mall services required for processing payment for a
product determined by a buyer from a list of products, processing
delivery involving procedures such as notifying information about a
paid product, or processing location tracking of a product being
delivered or inquiry on the result of location tracking, thereby
enabling the paid product to delivered to a buyer.
The shopping mall server, which is a server to intermediate a
general sale, an auction, a dutch auction and a bargaining of a
product or a service between a seller and a buyer by operating an
online shopping mall service through the communication network 10,
has various products or services registered thereon from a seller
terminal through the communication network 10, and provides the
registered various products or services to the smartphone 200 of a
buyer through the communication network 10, thereby enabling the
buyer to purchase a desired product or service.
In addition, the web server of the shopping mall server connects
the buyer smartphone 200 to the shopping mall server through the
communication network 10, and provides various online shopping mall
services of the shopping mall server through an application related
to a certain webpage or a certain shopping mall.
Hereinafter, a security authentication method for a membership
login of an online website according to an exemplary embodiment of
the present invention will be described.
FIG. 7 is an overall flowchart showing a security authentication
method for a membership login of an online website according to an
exemplary embodiment of the present invention, FIG. 8 is an overall
flowchart showing operations among elements, which illustrates a
security authentication method for a membership login of an online
website according to an exemplary embodiment of the present
invention, FIG. 9 is a detailed flowchart showing operations
between a user terminal and a security authentication server, which
illustrates generation and issuance of one time use authentication
information in a security authentication method for a membership
login of an online website according to an exemplary embodiment of
the present invention, FIG. 10 is a detailed flowchart showing
operations between a smartphone and a security authentication
server, which illustrates a process of requesting OTP information
issuance in a security authentication method for a membership login
of an online website according to an exemplary embodiment of the
present invention, FIG. 11 is a detailed flowchart showing
operations between a smartphone and a security authentication
server, which illustrates a process of issuing and transmitting OTP
information in a security authentication method for a membership
login of an online website according to an exemplary embodiment of
the present invention, and FIG. 12 a detailed flowchart showing
operations between a user terminal and a security authentication
server, which illustrates a security authentication process on a
membership login of a certain online website in a security
authentication method for a membership login of an online website
according to an exemplary embodiment of the present invention.
Referring to FIGS. 1 to 12, a security authentication method for a
membership login of an online website according to an exemplary
embodiment of the present invention, first, includes by the
security authentication server 300, generating one time use
authentication information for a membership login of a certain
online website (for example, Auction and G market) requested by the
user terminal 100, and transmitting the generated one time use
authentication information to the user terminal 100 (S100).
Referring to FIG. 9, the user terminal 100 requests a one time use
authentication seed from the security authentication server 300 in
order to perform a membership login, and the security
authentication server 300 generates one time use authentication
information for a membership login of a certain online website.
In this case, the one time use authentication information generated
as such is composed of a randomly generated globally unique
identifier (GUID), an IP address of the user terminal 100 having
requested a membership login, a timestamp at the time of issuing
the one time use authentication information, and random data that
are arranged in the order of the GUID, the IP address of the user
terminal, the timestamp and the random data (see FIG. 2).
Thereafter, the security authentication server 300 makes the
generated one time use authentication information into a database
(DB) and stores the DB in the additional storage device 350. In
this case, the security authentication server 300 stores the
randomly generated GUID of the one time use authentication
information as a key or an index, and stores the remaining
information as a value or a column in the additional storage device
350.
Thereafter, the security authentication server 300, at the time of
transmitting the generated one time use authentication information
to the user terminal 100, encrypts the generated one time use
authentication information, and includes a hash value about the
generated one time use authentication information and information
about a length of the encrypted one time use authentication
information in the encrypted one time use authentication
information to be transmitted (see FIG. 3).
Meanwhile, the security authentication server 300 generates the one
time use authentication information in the form of a QR code image
and transmits the one time use authentication information such that
the one time use authentication information is displayed on the
screen of the user terminal 100 (see FIG. 4).
Thereafter, a security authentication related application or a
shopping mall related application that is installed on the
smartphone 200 scans and analyzes the one time use authentication
information transmitted in operation S100, and requests OTP
information from the security authentication server 300 by using
the analyzed one time use authentication information and actual
membership login authentication information of an online website
(S200).
Referring to FIG. 10, the security authentication related
application or the shopping mall related application that is
installed on the smartphone 200 scans one time use authentication
information displayed on the screen of the user terminal 100, that
is, scans an QR code image, extracts authentication seed data from
the scanned QR code, decrypts the extracted data (AES-256), and
then verifies fabrication/modification of the data through a
hash-based message authentication code (HMAC).
Thereafter, as an actual membership ID and an actual password of
the online website are entered in the security authentication
related application or the shopping mall related application
installed on the smartphone 200, the analyzed one time use
authentication information is combined with the actual membership
login authentication information of the online website (for
example, an authentication token data), and a cryptogram is created
from the result of combination (RSA encryption using a server side
issuance public key) so that an OTP request query is generated and
transmitted.
That is, a membership login for a certain online website is
requested by transmitting an OTP issuance requesting query after
connection to the security authentication server 300 through
HTTP/SSL security communication, and actual membership login
authentication information of the certain online website is
received in the form of a token data about a result of
authentication of the membership login. Meanwhile, as for an
automatic login, a stored token may be loaded.
Thereafter, the security authentication server 300 verifies the one
time use authentication information requested in operation S200 and
the actual membership login authentication information of the
online website, generates OTP information if a corresponding user
is an authenticated member, and transmits the generated OTP
information to the corresponding smartphone 200 (S300).
Referring to FIG. 11, the security authentication server 300, upon
receiving an OTP issuance request made by the smartphone 200,
verifies the one time use authentication information by referring
to the DB. In detail, the security authentication server 300
verifies validity of issuance of the one time use authentication
information by decrypting the OTP request query provided by the
smartphone 200 (RSA-256, Private Key) and then decrypting the one
time use authentication information (AES-256) to inquire about
details of a validated issuance of the one time use authentication
information by using the MID as a key (for example, within 10
minutes based on the timestamp). Thereafter, the security
authentication server 300 verifies a login token based on the
internal criteria of the certain online website, that is, verifies
actual membership login authentication information of the certain
online website.
Thereafter, the security authentication server 300 generates OTP
information if a corresponding user is an authenticated member, and
transmits the generated OTP information to the corresponding
smartphone 200. That is, the security authentication server 300
generates random numbers (eight decimal digits) corresponding to
OTP information, and a basic value (seed) for generating the random
numbers may be composed of an IP address of the smartphone 200
having requested the OTP information, a GUID included in the one
time use authentication information, an IP address of the user
terminal 100 having requested the authentication, and a timestamp
of the user terminal 100.
Meanwhile, the GUID of the authentication request seed may be
stored as a key, and the ID of the authenticated member may be
stored as a value in the additional storage device 350.
Thereafter, the user terminal 100 requests a security
authentication for the membership login of the online website from
the security authentication server 300, by using the OTP
information transmitted in operation S300 and the one time use
authentication information transmitted in operation S100
(S400).
In this case, the user terminal 100, at the time of requesting the
security authentication for the membership login of the certain
online website, may simultaneously transmit the one time use
authentication information to a browser cookie and transmit the OTP
information to a Form (HTTP Post) value.
Finally, the security authentication server 300 performs a
verification process on the security authentication for the
membership login of the certain online website requested in
operation S400, and if the user is a security authenticated member,
normally processes the membership login of the certain online
website by using a membership ID on the record of OTP issuance
(S500).
Referring to FIG. 12, first, a user checks OTP information
displayed on a screen of the smartphone 200 of the user, and enters
the checked OTP information (for example, eight digit numbers) into
an OTP information entry field displayed on the screen of the user
terminal 100 in a certain webpage, and presses a send key (see FIG.
6) so that the user terminal 100 requests a security authentication
for a membership login of the certain online website by using the
one time use authentication information (that is, a QR code) and
the entered OTP information.
In this case, a security authentication requesting seed may be
transmitted to a browser cookie, and at the same time, the entered
OTP information may be transmitted to a Form (HTTP Post) value, and
such a transmission may be performed through a HTTP/SSL security
communication.
Thereafter, the security authentication server 300 performs a
verification process on the security authentication. First, the
security authentication server 300 extracts one time use
authentication information from a user cookie requested by the user
terminal 100; verifies a validity of issuance of the one time use
authentication information by decrypting the authentication
requesting seed (AES-256) to inquire about details of a validated
issuance of the one time use authentication information by using a
GUID as a key (for example, within 10 minutes based on the
timestamp); and also verifies a validity of issuance of the OTP by
comparing the extracted one time use authentication information
with a record of OTP issuance.
Meanwhile, the security authentication method for a membership
login of an online website according to the exemplary embodiment of
the present invention may be implemented as a code in a recording
medium that is readable by a computer. The computer readable
recording medium may include all types of recording devices storing
data readable by a computer system.
For example, the computer readable recording medium may include a
read-only memory (ROM), a random-access memory (RAM), a CD-ROM, a
magnetic tape, a hard disk, a floppy disk, a mobile storage device,
a non-volatile memory, and an optical data storage device.
In addition, the computer readable recording medium may be
distributed over a computer system connected through a computer
communication network, so that the computer readable code is stored
as a code and executed in a distributed fashion.
As is apparent from the above, the security authentication system
for a membership login of an online website according to the
present invention and the method thereof can ensure a safe
membership login without having to directly entering a membership
ID and a password for a membership login of a certain online
website on a user terminal being used in association with a
smartphone for a private or public purpose.
It will be apparent to those skilled in the art that various
modifications can be made to the security authentication system for
membership login of an online website according to the
above-described exemplary embodiments of the present invention and
the method thereof without departing from the spirit or scope of
the invention. Thus, it is intended that the present invention
covers all such modifications provided they come within the scope
of the appended claims and their equivalents.
* * * * *